diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 380f1a7d27e2..fbbebc2520a3 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -429,6 +429,7 @@ in {
   nginx-etag = handleTest ./nginx-etag.nix {};
   nginx-http3 = handleTest ./nginx-http3.nix {};
   nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
+  nginx-njs = handleTest ./nginx-njs.nix {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
   nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};
diff --git a/nixos/tests/nginx-njs.nix b/nixos/tests/nginx-njs.nix
new file mode 100644
index 000000000000..72be16384f1b
--- /dev/null
+++ b/nixos/tests/nginx-njs.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "nginx-njs";
+
+  nodes.machine = { config, lib, pkgs, ... }: {
+    services.nginx = {
+      enable = true;
+      additionalModules = [ pkgs.nginxModules.njs ];
+      commonHttpConfig = ''
+        js_import http from ${builtins.toFile "http.js" ''
+          function hello(r) {
+              r.return(200, "Hello world!");
+          }
+          export default {hello};
+        ''};
+      '';
+      virtualHosts."localhost".locations."/".extraConfig = ''
+        js_content http.hello;
+      '';
+    };
+  };
+  testScript = ''
+    machine.wait_for_unit("nginx")
+
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
+    assert "Hello world!" == response, f"Expected 'Hello world!', got '{response}'"
+  '';
+})
diff --git a/pkgs/applications/audio/hivelytracker/default.nix b/pkgs/applications/audio/hivelytracker/default.nix
index 8f9e3809fd2d..b87ad68ceee7 100644
--- a/pkgs/applications/audio/hivelytracker/default.nix
+++ b/pkgs/applications/audio/hivelytracker/default.nix
@@ -2,36 +2,32 @@
 , stdenv
 , fetchFromGitHub
 , pkg-config
-, makeWrapper
 , SDL
 , SDL_image
 , SDL_ttf
-, gtk2
-, glib
+, gtk3
 }:
 
 stdenv.mkDerivation rec {
   pname = "hivelytracker";
-  version = "unstable-2020-08-19";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "pete-gordon";
     repo = "hivelytracker";
-    rev = "c8e3c7a5ee9f4a07cb4a941caecf7e4c4f4d40e0";
-    sha256 = "1nqianlf1msir6wqwapi7ys1vbmf6aik58wa54b6cn5v6kwxh75a";
+    rev = "V${lib.replaceStrings ["."] ["_"] version}";
+    sha256 = "148p320sd8phcpmj4m85ns5zly2dawbp8kgx9ryjfdk24pa88xg6";
   };
 
   nativeBuildInputs = [
     pkg-config
-    makeWrapper
   ];
 
   buildInputs = [
     SDL
     SDL_image
     SDL_ttf
-    gtk2
-    glib
+    gtk3
   ];
 
   makeFlags = [
@@ -40,28 +36,12 @@ stdenv.mkDerivation rec {
     "PREFIX=$(out)"
   ];
 
-  # TODO: try to exclude gtk and glib from darwin builds
-  NIX_CFLAGS_COMPILE = [
-    "-I${SDL}/include/SDL"
-    "-I${SDL_image}/include/SDL"
-    "-I${SDL_ttf}/include/SDL"
-    "-I${gtk2.dev}/include/gtk-2.0"
-    "-I${glib.dev}/include/glib-2.0"
-  ];
-
   # Also build the hvl2wav tool
   postBuild = ''
     make -C hvl2wav
   '';
 
   postInstall = ''
-    # https://github.com/pete-gordon/hivelytracker/issues/43
-    # Ideally we should patch the sources, but the program can't open
-    # files passed as arguments anyway, so this works well enough until the
-    # issue is fixed.
-    wrapProgram $out/bin/hivelytracker \
-      --chdir "$out/share/hivelytracker"
-
     # Also install the hvl2wav tool
     install -Dm755 hvl2wav/hvl2wav $out/bin/hvl2wav
   '';
@@ -86,4 +66,3 @@ stdenv.mkDerivation rec {
     broken = stdenv.isDarwin; # TODO: try to use xcbuild
   };
 }
-
diff --git a/pkgs/applications/audio/termusic/default.nix b/pkgs/applications/audio/termusic/default.nix
index 5cf216a6e21b..08420191127d 100644
--- a/pkgs/applications/audio/termusic/default.nix
+++ b/pkgs/applications/audio/termusic/default.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "termusic";
-  version = "0.7.3";
+  version = "0.7.5";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-5I9Fu+A5IBfaxaPcYKTzWq3/8ts0BPSOOVeU6D61dbc=";
+    sha256 = "sha256-/wpaxXY0hT7XX44cW1f3JuowE5u46/aLMC2VXgty/jE=";
   };
 
-  cargoHash = "sha256-R/hElL0MjeBqboJTQkIREPOh+/YbdKtUAzqPD6BpSPs=";
+  cargoHash = "sha256-TznzZ1dcun57IQ8e2T2FOxSdyqxS6etnuvxOY8n1y14=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ alsa-lib ];
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index fc95295d3d9e..c778ce3f7575 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lighthouse";
-  version = "3.1.2";
+  version = "3.2.1";
 
   # lighthouse/common/deposit_contract/build.rs
   depositContractSpecVersion = "0.12.1";
@@ -27,10 +27,10 @@ rustPlatform.buildRustPackage rec {
     owner = "sigp";
     repo = "lighthouse";
     rev = "v${version}";
-    hash = "sha256-EJFg6ZjxxijxJNMwKRh0cYeqwujUV3OJgXBvBRsnbVI=";
+    sha256 = "sha256-Aqc3kk1rquhLKNZDlEun4bQpKI4Nsk7+Wr7E2IkJQEs=";
   };
 
-  cargoHash = "sha256-iXqRtBqvM9URQsL8qGmpr3CNX2fpbtDOaluibAX/lWo=";
+  cargoSha256 = "sha256-wGEk7OfEmyeRW65kq5stvKCdnCjfssyXUmNWGkGq42M=";
 
   buildFeatures = [ "modern" "gnosis" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix b/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
index e518590a9167..15564de27271 100644
--- a/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gurk-rs/default.nix
@@ -3,30 +3,35 @@
 , protobuf
 , rustPlatform
 , fetchFromGitHub
+, Cocoa
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "gurk-rs";
-  version = "0.2.5";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "boxdot";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-CEsnZ0V85eOH+bjtico5yo9kS6eMT7Dx3H6wiDUjQm4=";
+    sha256 = "sha256-uJvi082HkWW9y8jwHTvzuzBAi7uVtjq/4U0bO0EWdVM=";
   };
 
   postPatch = ''
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-z+2G/hD1zYOoJrYFB0eEP6y9MoV2OfdkJVt6je94EkU=";
-  buildInputs = [ protobuf ];
+  cargoHash = "sha256-jS6wAswGqgfmpPV6qERhqn1IhpcBSDNh8HDdPo04F0A=";
+
+  nativeBuildInputs = [ protobuf ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Cocoa ];
+
+  NIX_LDFLAGS = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ "-framework" "AppKit" ];
 
   PROTOC = "${protobuf}/bin/protoc";
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Signal Messenger client for terminal";
     homepage = "https://github.com/boxdot/gurk-rs";
     license = licenses.agpl3Only;
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index f266261775c5..aa1ad43fbb55 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.26";
+  version = "1.3.27";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eVqiY/AomnKbN83hSB66EIuGD82Ilx+ybQtBMyX57WY=";
+    sha256 = "sha256-y6YlSzLZXNL7GkP0SNXQgt16W2AohGaGjshNq9GoCtA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/ocaml-modules/eqaf/default.nix b/pkgs/development/ocaml-modules/eqaf/default.nix
index ba2274e9c326..d3e29be3c688 100644
--- a/pkgs/development/ocaml-modules/eqaf/default.nix
+++ b/pkgs/development/ocaml-modules/eqaf/default.nix
@@ -1,17 +1,16 @@
-{ lib, fetchurl, buildDunePackage, cstruct, bigarray-compat }:
+{ lib, fetchurl, buildDunePackage, cstruct }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.07";
   pname = "eqaf";
-  version = "0.8";
-  useDune2 = true;
+  version = "0.9";
 
   src = fetchurl {
-    url = "https://github.com/mirage/eqaf/releases/download/v${version}/eqaf-v${version}.tbz";
-    sha256 = "sha256-EUWhYBB0N9eUPgLkht9r0jPTk37BpZfX+jntuUcc+HU=";
+    url = "https://github.com/mirage/eqaf/releases/download/v${version}/eqaf-${version}.tbz";
+    sha256 = "sha256-7A4oqUasaBf5XVhU8FqZYa46hAi7YQ55z60BubJV3+A=";
   };
 
-  propagatedBuildInputs = [ cstruct bigarray-compat ];
+  propagatedBuildInputs = [ cstruct ];
 
   meta = {
     description = "Constant time equal function to avoid timing attacks in OCaml";
diff --git a/pkgs/development/ocaml-modules/janestreet/0.15.nix b/pkgs/development/ocaml-modules/janestreet/0.15.nix
index 522d08c1b190..3a4a20822c80 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.15.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.15.nix
@@ -165,7 +165,8 @@ with self;
 
   base = janePackage {
     pname = "base";
-    hash = "1qyycqqr4dijvxm4hhy79c964wd91kpsfvb89kna1qwgllg0hrpj";
+    version = "0.15.1";
+    hash = "sha256-CDKQVF+hAvJTo5QmRvyOfQNrdRgz6m+64q9UzNHlJEA=";
     minimumOCamlVersion = "4.10";
     meta.description = "Full standard library replacement for OCaml";
     buildInputs = [ dune-configurator ];
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 61f31f620041..d36f8910dbb0 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.2.16";
+  version = "2.2.17";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Dr7K71wEk46UPyNp3FRuRVqfOn40X059lf3yojM57cc=";
+    hash = "sha256-eqLWHa7qUZ6UzNr9onwF2xmntKwdbNMWt2KvwG3kQjc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bluetooth-adapters/default.nix b/pkgs/development/python-modules/bluetooth-adapters/default.nix
index 3d541bfa7bc0..1ad12fffd505 100644
--- a/pkgs/development/python-modules/bluetooth-adapters/default.nix
+++ b/pkgs/development/python-modules/bluetooth-adapters/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-adapters";
-  version = "0.6.0";
+  version = "0.7.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-26w7513h5WWGqKz4OqHob42O0bk1yW8ePPKB2V9+AHs=";
+    hash = "sha256-c6blw0WD1V4bNZ5YaVjLbeCIug8l7PeKlrv+kzncK/s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 9f0014c16feb..be18b892a2e2 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "2.1.0";
+  version = "2.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4vk9uaG/9n3lNEWAergW9kFN2/Ta/KSax0rK9tVxAfw=";
+    hash = "sha256-jjFYJ6EF4G43EOKCdkE1KQqaV2aGD+HMh1tOxHWUn8k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cairocffi/default.nix b/pkgs/development/python-modules/cairocffi/default.nix
index cc4e19d6beb7..87c56b40e9e3 100644
--- a/pkgs/development/python-modules/cairocffi/default.nix
+++ b/pkgs/development/python-modules/cairocffi/default.nix
@@ -7,6 +7,7 @@
 , substituteAll
 , makeFontsConf
 , freefont_ttf
+, pikepdf
 , pytest
 , glibcLocales
 , cairo
@@ -21,42 +22,15 @@
 
 buildPythonPackage rec {
   pname = "cairocffi";
-  version = "1.3.0";
+  version = "1.4.0";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-EIo6fLCeIDvdhQHZuq2R14bSBFYb1x6TZOizSJfEe5E=";
+    sha256 = "sha256-UJM5syzNjXsAwiBMMnNs3njbU6MuahYtMSR40lYmzZo=";
   };
 
-  LC_ALL = "en_US.UTF-8";
-
-  # checkPhase require at least one 'normal' font and one 'monospace',
-  # otherwise glyph tests fails
-  FONTCONFIG_FILE = makeFontsConf {
-    fontDirectories = [ freefont_ttf ];
-  };
-
-  propagatedBuildInputs = [ cairo cffi ] ++ lib.optional withXcffib xcffib;
-  propagatedNativeBuildInputs = [ cffi ];
-
-  # pytestCheckHook does not work
-  checkInputs = [ numpy pytest glibcLocales ];
-
-  postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "pytest-runner" "" \
-      --replace "pytest-cov" "" \
-      --replace "pytest-flake8" "" \
-      --replace "pytest-isort" "" \
-      --replace "--flake8 --isort" ""
-  '';
-
-  checkPhase = ''
-    py.test $out/${python.sitePackages}
-  '';
-
   patches = [
     # OSError: dlopen() failed to load a library: gdk-pixbuf-2.0 / gdk-pixbuf-2.0-0
     (substituteAll {
@@ -69,6 +43,35 @@ buildPythonPackage rec {
     ./fix_test_scaled_font.patch
   ];
 
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace "pytest-runner" "" \
+      --replace "pytest-cov" "" \
+      --replace "pytest-flake8" "" \
+      --replace "pytest-isort" "" \
+      --replace "--flake8 --isort" ""
+  '';
+
+  LC_ALL = "en_US.UTF-8";
+
+  # checkPhase require at least one 'normal' font and one 'monospace',
+  # otherwise glyph tests fails
+  FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };
+
+  propagatedNativeBuildInputs = [ cffi ];
+
+  propagatedBuildInputs = [ cairo cffi ]
+    ++ lib.optional withXcffib xcffib;
+
+  # pytestCheckHook does not work
+  checkInputs = [ numpy pikepdf pytest glibcLocales ];
+
+  checkPhase = ''
+    py.test $out/${python.sitePackages}
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/SimonSapin/cairocffi";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/cometblue-lite/default.nix b/pkgs/development/python-modules/cometblue-lite/default.nix
index 564e1969461a..eea0b8dac04d 100644
--- a/pkgs/development/python-modules/cometblue-lite/default.nix
+++ b/pkgs/development/python-modules/cometblue-lite/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "cometblue-lite";
-  version = "0.5.2";
+  version = "0.5.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "neffs";
     repo = "python-cometblue_lite";
     rev = version;
-    hash = "sha256-23HspTZ0kN3+geDnqdH6Vj5NfmmbVku2vPTdsy0XvRU=";
+    hash = "sha256-KRWS2nqMFlF+IcBSmnQH3ptp6yxRQjAFY6aY0D7eZBs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/djangorestframework/default.nix b/pkgs/development/python-modules/djangorestframework/default.nix
index ca81d7bd57bb..1fb8fd9f4b0a 100644
--- a/pkgs/development/python-modules/djangorestframework/default.nix
+++ b/pkgs/development/python-modules/djangorestframework/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , coreapi
 , django
 , django-guardian
@@ -15,26 +14,16 @@
 
 buildPythonPackage rec {
   pname = "djangorestframework";
-  version = "3.13.1";
+  version = "3.14.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = "django-rest-framework";
     rev = version;
-    sha256 = "sha256-XmX6DZBZYzVCe72GERplAWt5jIjV/cYercZGb0pYjoc=";
+    sha256 = "sha256-Fnj0n3NS3SetOlwSmGkLE979vNJnYE6i6xwVBslpNz4=";
   };
 
-  patches = [
-    # See https://github.com/encode/django-rest-framework/issues/8608
-    # and https://github.com/encode/django-rest-framework/pull/8591/
-    (fetchpatch {
-      name = "fix-django-collect-static.patch";
-      url = "https://github.com/encode/django-rest-framework/pull/8591/commits/65943bb58deba6ee1a89fe4504f270ab1806fce6.patch";
-      sha256 = "sha256-wI7EzX9tlyyXAPrJEr+/2uTg7dVY98IKgh7Cc/NZo5k=";
-    })
-  ];
-
   propagatedBuildInputs = [
     django
     pytz
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index d7878bd6a44d..c61dfc9f4da4 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -19,6 +19,7 @@ buildPythonPackage rec {
 
   preConfigure = ''
     cd tools/pythonpkg
+    substituteInPlace setup.py --replace "multiprocessing.cpu_count()" "$NIX_BUILD_CORES"
   '';
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/google-auth-oauthlib/default.nix b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
index d5e7848b3e46..9f70702883a0 100644
--- a/pkgs/development/python-modules/google-auth-oauthlib/default.nix
+++ b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-auth-oauthlib";
-  version = "0.5.2";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1emKcSAzMGmfkqJrwIhHqS6MOxuNgqAh8a80Fk2xQ64=";
+    sha256 = "sha256-2xG85LPv/Jm1GOwiopA0cOCFPAySvldpTjaE5zjSJRM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index 8a4c8474adc2..2a411783fff3 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -27,11 +27,11 @@
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.11.0";
+  version = "2.14.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-7WXs+faBgyKY4pMo4e8KNnbjcysuVvQVMtRfcKIt4Ps=";
+    sha256 = "sha256-zySBeFXYdO3i79BxqiISVEX1Vd4Whbc5qXgvz0CMKj0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-crc32c/default.nix b/pkgs/development/python-modules/google-crc32c/default.nix
index d3cc01e45380..2fd5dc315e5d 100644
--- a/pkgs/development/python-modules/google-crc32c/default.nix
+++ b/pkgs/development/python-modules/google-crc32c/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "google-crc32c";
-  version = "1.3.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-crc32c";
     rev = "v${version}";
-    sha256 = "005ra4pfv71rq53198k7q6k63f529q3g6hkbxbwfcf82jr77hxga";
+    sha256 = "sha256-Tx7UBIwKzSBbpuqdqGiXTbmBE+1MDRknVe3Zee0UHKQ=";
   };
 
   buildInputs = [ crc32c ];
diff --git a/pkgs/development/python-modules/google-resumable-media/default.nix b/pkgs/development/python-modules/google-resumable-media/default.nix
index 41b41be8fbb4..0820ac217f19 100644
--- a/pkgs/development/python-modules/google-resumable-media/default.nix
+++ b/pkgs/development/python-modules/google-resumable-media/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "google-resumable-media";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-J8UmIL02TRyBFuqsTqKvy/uBrpE5+zGZZS/KwXJL+2w=";
+    sha256 = "sha256-jVUYUC+SuezISsRneb1PCWlOyzujij58pzeobRXLyh8=";
   };
 
   propagatedBuildInputs = [ google-auth google-crc32c requests ];
diff --git a/pkgs/development/python-modules/hexbytes/default.nix b/pkgs/development/python-modules/hexbytes/default.nix
index 79fc42ae3d02..563035f50df4 100644
--- a/pkgs/development/python-modules/hexbytes/default.nix
+++ b/pkgs/development/python-modules/hexbytes/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "hexbytes";
-  version = "0.2.2";
+  version = "0.3.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = "hexbytes";
     rev = "v${version}";
-    sha256 = "sha256-SZscM6ze9yY+iRDx/5F4XbrLXIbp6QkFnzxN7zvP9CQ=";
+    sha256 = "sha256-EDFE5MUc+XMwe8BaXkz/DRchAZbS86X+AcShi5rx83M=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/oralb-ble/default.nix b/pkgs/development/python-modules/oralb-ble/default.nix
index 8905529f6dec..cae423cf5a95 100644
--- a/pkgs/development/python-modules/oralb-ble/default.nix
+++ b/pkgs/development/python-modules/oralb-ble/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "oralb-ble";
-  version = "0.10.1";
+  version = "0.14.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Iuu44H8fCbJysoSJLBtlJ1XE5Ad2caWihj3UZytWK3o=";
+    hash = "sha256-7EHU/UqKy576FZ1E5bOHHOvH38yoyU+55wC/YO3yt4Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 26662c7e6f01..0bc838839e6c 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "7.3.1";
+  version = "7.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G2ujLjN8LEHY9gd0SWBpOSkV6fQAZ8pojR0+bMi6TUw=";
+    hash = "sha256-+DihyuSzqFoQvDnlYUyvdyjravxMcU8PgYEq2FY2o9g=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index afa5f0c378b1..f448942ae01d 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "7.3.0";
+  version = "7.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "jabesq";
     repo = "pyatmo";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-3NgAsXMdt4FsE30oxeTfunpP2e+iqLFZkhMJbc5jVGw=";
+    sha256 = "sha256-0AgmH0cxXPUBzC30HyX68WsSyYsDcPaVQHLOIsZbHzI=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 5378e007e792..be3548fad0b9 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.5.6";
+  version = "1.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8Xzrnt5W3kQf+kHHiAWimyw4uHc3UL9BsZePcAYKHNk=";
+    hash = "sha256-TWX/8O57gNqkm1ZqreZfy1AQ6UcgP4FODDpXteqO5q8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sensor-state-data/default.nix b/pkgs/development/python-modules/sensor-state-data/default.nix
index 20bd058fdf5a..1ef15fee0af3 100644
--- a/pkgs/development/python-modules/sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sensor-state-data";
-  version = "2.10.1";
+  version = "2.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-pCo9CMX+CQBFuK5rbMHsxQEdBHvp1EZA7A9Ykm68NCw=";
+    hash = "sha256-znDEdXCWYmzk5xG1sSUyXRUhLGxtoBv46JcSnysu1A4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/spidev/default.nix b/pkgs/development/python-modules/spidev/default.nix
index 90ca839bc1e0..2676563430b1 100644
--- a/pkgs/development/python-modules/spidev/default.nix
+++ b/pkgs/development/python-modules/spidev/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "spidev";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "03cicc9kpi5khhq0bl4dcy8cjcl2j488mylp8sna47hnkwl5qzwa";
+    sha256 = "sha256-FNvDdZSkqu+FQDq2F5hdPD70ZNYrybdp71UttTcBEVs=";
   };
 
   # package does not include tests
diff --git a/pkgs/development/python-modules/zamg/default.nix b/pkgs/development/python-modules/zamg/default.nix
index 474907593a6c..11066aa26332 100644
--- a/pkgs/development/python-modules/zamg/default.nix
+++ b/pkgs/development/python-modules/zamg/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "zamg";
-  version = "0.1.1";
+  version = "0.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "killer0071234";
     repo = "python-zamg";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mVJ1zuh3v803XgynQiUvt6whTmXxGS7SEtr6IDm4kz4=";
+    hash = "sha256-R3byV8llg7X+KYuYTsEtdLSFfLsPD4tyqAaU0CifDks=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index f8d23d3fcec0..e73587ece3c9 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.361.2";
+  version = "2.361.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-QRp5x+DVCCdFBx4mEIE0aqTKJ/ZJ/rBBdW0dJ6mD2/Y=";
+    hash = "sha256-85y40J/RfHLcCWURzlDyRfwwBNECKqr2BCGlNvdAybk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/games/warzone2100/default.nix b/pkgs/games/warzone2100/default.nix
index 2df306d686f2..4adb079ebaa0 100644
--- a/pkgs/games/warzone2100/default.nix
+++ b/pkgs/games/warzone2100/default.nix
@@ -11,6 +11,7 @@
 , SDL2
 , libtheora
 , libvorbis
+, libopus
 , openal
 , openalSoft
 , physfs
@@ -42,17 +43,18 @@ in
 
 stdenv.mkDerivation rec {
   inherit pname;
-  version  = "4.2.7";
+  version  = "4.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/releases/${version}/${pname}_src.tar.xz";
-    sha256 = "sha256-f1J84A7aRAmbGn48MD7eJ2+DX21q2UWwYAoXXdq7ALA=";
+    sha256 = "sha256-GdHe8DskEd0G1E388z8GGOtjTqHTMBpFSxf1MNATGN0=";
   };
 
   buildInputs = [
     SDL2
     libtheora
     libvorbis
+    libopus
     openal
     openalSoft
     physfs
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 09f58becbab4..7d8a6716bc97 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, fetchFromGitLab, lib, pkgs }:
+{ fetchFromGitHub, fetchFromGitLab, fetchhg, lib, pkgs }:
 
 let
 
@@ -290,6 +290,28 @@ in
       } + "/naxsi_src";
   };
 
+  njs = rec {
+    src = fetchhg {
+      url = "https://hg.nginx.org/njs";
+      rev = "0.7.8";
+      sha256 = "sha256-jsR8EOeW8tAo2utKznuUaCG4hK0oU0ZJSnnGmI5HUDk=";
+      name = "nginx-njs";
+    };
+
+    # njs module sources have to be writable during nginx build, so we copy them
+    # to a temporary directory and change the module path in the configureFlags
+    preConfigure = ''
+      NJS_SOURCE_DIR=$(readlink -m "$TMPDIR/${src}")
+      mkdir -p "$(dirname "$NJS_SOURCE_DIR")"
+      cp --recursive "${src}" "$NJS_SOURCE_DIR"
+      chmod -R u+rwX,go+rX "$NJS_SOURCE_DIR"
+      export configureFlags="''${configureFlags/"${src}"/"$NJS_SOURCE_DIR/nginx"}"
+      unset NJS_SOURCE_DIR
+    '';
+
+    inputs = [ pkgs.which ];
+  };
+
   opentracing = {
     src =
       let src' = fetchFromGitHub {
diff --git a/pkgs/tools/misc/android-tools/default.nix b/pkgs/tools/misc/android-tools/default.nix
index 4d5eff546cc0..bb56d4fa9f8a 100644
--- a/pkgs/tools/misc/android-tools/default.nix
+++ b/pkgs/tools/misc/android-tools/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, fetchpatch
 , cmake, perl, go, python3
-, protobuf, zlib, gtest, brotli, lz4, zstd, libusb1, pcre2, fmt_7
+, protobuf, zlib, gtest, brotli, lz4, zstd, libusb1, pcre2
 }:
 
 let
@@ -9,22 +9,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "android-tools";
-  version = "31.0.3p1";
+  version = "33.0.3";
 
   src = fetchurl {
     url = "https://github.com/nmeum/android-tools/releases/download/${version}/android-tools-${version}.tar.xz";
-    sha256 = "1f2svy381r798hjinrc2xiwz13gkkqxfill343zvv8jqkn8rzxhf";
+    hash = "sha256-jOF02reB1d69Ke0PllciMfd3vuGbjvPBZ+M9PqdnC8U=";
   };
 
   patches = [
-    # fmt 8 breaks the build but we can use fmt 7 from Nixpkgs:
-    (fetchpatch {
-      # Vendor google's version of fmtlib
-      url = "https://github.com/nmeum/android-tools/commit/21061c1dfb006c22304053c1f6f9e48ae4cbe25a.patch";
-      sha256 = "17mcsgfc3i8xq4hck0ppnzafh15aljxy7j2q4djcmwnvrkv9kx3s";
-      revert = true;
-      excludes = [ "vendor/fmtlib" ];
-    })
     ./android-tools-kernel-headers-6.0.diff
   ];
 
@@ -37,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ cmake perl go ];
-  buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 fmt_7 ];
+  buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 ];
   propagatedBuildInputs = [ pythonEnv ];
 
   # Don't try to fetch any Go modules via the network:
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index e8dc5e370bea..d46d8bd2c576 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -1,20 +1,40 @@
-{ lib, stdenv, fetchFromGitHub, nodejs, which, python3, util-linux, nixosTests }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, nodejs
+, which
+, python39
+, libuv
+, util-linux
+, nixosTests
+}:
 
-stdenv.mkDerivation rec {
+rustPlatform.buildRustPackage rec {
   pname = "cjdns";
-  version = "21.1";
+  version = "21.4";
 
   src = fetchFromGitHub {
     owner = "cjdelisle";
     repo = "cjdns";
     rev = "cjdns-v${version}";
-    sha256 = "NOmk+vMZ8i0E2MjrUzksk+tkJ9XVVNEXlE5OOTNa+Y0=";
+    sha256 = "sha256-vI3uHZwmbFqxGasKqgCl0PLEEO8RNEhwkn5ZA8K7bxU=";
   };
 
-  buildInputs = [ which python3 nodejs ] ++
+  cargoSha256 = "sha256-x3LxGOhGXrheqdke0eYiQVo/IqgWgcDrDNupdLjRPjA=";
+
+  nativeBuildInputs = [
+    which
+    python39
+    nodejs
+  ] ++
     # for flock
     lib.optional stdenv.isLinux util-linux;
 
+  buildInputs = [
+    libuv
+  ];
+
   NIX_CFLAGS_COMPILE = [
     "-O2"
     "-Wno-error=array-bounds"
@@ -24,15 +44,6 @@ stdenv.mkDerivation rec {
     "-Wno-error=stringop-overread"
   ];
 
-  buildPhase =
-    lib.optionalString stdenv.isAarch32 "Seccomp_NO=1 "
-    + "bash do";
-  installPhase = ''
-    install -Dt "$out/bin/" cjdroute makekeys privatetopublic publictoip6
-    mkdir -p $out/share/cjdns
-    cp -R tools node_build node_modules $out/share/cjdns/
-  '';
-
   passthru.tests.basic = nixosTests.cjdns;
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/dnsmonster/default.nix b/pkgs/tools/networking/dnsmonster/default.nix
index 201e31f9845b..eac3f61f30cc 100644
--- a/pkgs/tools/networking/dnsmonster/default.nix
+++ b/pkgs/tools/networking/dnsmonster/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "dnsmonster";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "mosajjal";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-csYJ8jdk84Uf0Sti5wGK27NH9FFHzUHFJXV8r4FWO68=";
+    hash = "sha256-MiFwGVvaShy7dEKixIXdRCBmRc2YnxX49/7R8JugXng=";
   };
 
-  vendorSha256 = "sha256-+Wpn9VhFDx5NPk7lbp/iP3kdn3bvR+AL5nfivu8944I=";
+  vendorSha256 = "sha256-ZCtxKMD9hESERcsptdhxdV51nxyvrdj+guTodn/Sqao=";
 
   buildInputs = [
     libpcap
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d0edb2282cb2..fa0ae4ccc3e4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -28504,7 +28504,9 @@ with pkgs;
     fftw = fftwSinglePrec;
   };
 
-  gurk-rs = callPackage ../applications/networking/instant-messengers/gurk-rs { };
+  gurk-rs = callPackage ../applications/networking/instant-messengers/gurk-rs {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
 
   gjay = callPackage ../applications/audio/gjay { };